Toolkit · Commercial

The Anti-Corruption and Global Compliance Toolkit

15 U.S.C. §§ 78

Type
Toolkit
Jurisdiction
National
Date
2025-11-07
Topic
Commercial

A resource map for anti-corruption practice, organized around the twelve places these matters actually break. It covers the two halves of the FCPA and why the accounting provisions generate more enforcement than the bribery provisions, the foreign official definition that sweeps in state-owned enterprise employees across much of the world, the third-party intermediary risk that accounts for most enforcement actions, the hospitality and charitable and hiring patterns that produce cases through drift rather than intent, the books-and-records and internal controls obligations with no materiality threshold, the jurisdictional reach and the limit Hoskins imposed, the attribution theories that reach parents and acquirers and joint venture participants, the program design that answers the three questions enforcement agencies actually ask, the cross-border investigation constraints of privilege and blocking statutes and data transfer, the self-disclosure calculus and what a declination buys, the global regime led by the UK Bribery Act's failure-to-prevent offense, and the adjacent statutes prosecutors use when the FCPA does not reach. Each pillar gives the doctrine, the anchor authority, the trap, and links into the UpLaw documents that develop it. It closes with an authority shelf, a red flag register, and a first-ninety-days sequence.

The Anti-Corruption and Global Compliance Toolkit

Commercial > Anti-Corruption | Published 7 November 2025 - Updated 18 July 2026 | UpLaw - uplaw.us

Almost no enforcement action begins with someone handing over a briefcase. It begins with a consultant nobody diligenced, a fee structure nobody questioned, and four years of payments nobody can explain. The sentence that appears in every resolution document is some version of: the company was unable to identify any services performed.

Keywords: FCPA, anti-bribery, books and records, internal controls, foreign official, Esquenazi, third-party risk, hospitality, Hoskins, successor liability, self-disclosure, monitorship, UK Bribery Act, adequate procedures, FEPA

How to read this toolkit

This is a resource map, not a treatise. It walks twelve pillars of anti-corruption practice. Under each you get the governing doctrine in plain terms, the anchor authority, the trap that catches people, and the UpLaw documents that develop it.

Four ground rules first.

One: the accounting provisions are the larger exposure. They apply only to issuers, but they require no bribe, have no materiality threshold, and generate more enforcement than the bribery provisions do. A program aimed only at bribery leaves the bigger risk unmanaged.

Two: third parties are the risk. Agents, consultants, distributors, brokers, and joint venture partners account for the large majority of enforcement actions. Everything else is smaller.

Three: U.S. law is not the whole picture. The UK Bribery Act's section 7 failure-to-prevent offense is strict liability with only an "adequate procedures" defense, covers commercial bribery, has no facilitation payment exception, and reaches any organization carrying on part of a business in the UK. For many multinationals it is the harder standard.

Four: enforcement policy moves; exposure does not. Charging policy, disclosure credit, and monitor practice change with administrations and have changed materially. The limitations period does not care. A company that relaxes controls during a permissive period is building a file that will be read during a restrictive one.

Start here for the doctrinal treatment: The Foreign Corrupt Practices Act: A Comprehensive Guide to Anti-Bribery, Books and Records, and Global Enforcement. For the narrative introduction: Grease, Gifts, and Third Parties. For the build sequence: Building an Anti-Corruption Compliance Program: A Practical Checklist.

Our running matters. Verdant Terminals, Inc. (fictional), a U.S.-listed logistics company with Southeast Asian port operations. PT Sumber Mitra (fictional), its customs consultant. Halcyon Renewables plc (fictional), a UK acquisition target.

Pillar 1 — The two halves

Doctrine. Anti-bribery provisions require corrupt intent, a thing of value, a foreign official, and a business purpose. Accounting provisions require only that an issuer's books inaccurately reflect a transaction, or that its internal accounting controls be inadequate.

Anchors. 15 U.S.C. §§ 78dd-1, 78dd-2, 78dd-3; 15 U.S.C. § 78m(b)(2); § 78m(b)(5) (knowing circumvention); § 78ff (penalties); DOJ/SEC, A Resource Guide to the U.S. Foreign Corrupt Practices Act (2d ed. 2020).

Trap. Assuming financial-statement materiality applies. It does not. "Reasonable detail" is defined at § 78m(b)(7) as what would satisfy prudent officials in the conduct of their own affairs. A $40,000 mischaracterized payment in a multibillion-dollar company is actionable.

Trap, second order. Books-and-records and internal controls charges are routinely brought without any bribery charge. The theory is that controls over third-party engagement or payment approval were inadequate — full stop.

Go deeper: The Foreign Corrupt Practices Act: A Comprehensive Guide · Public Company Disclosure and Reporting: A Practical Checklist

Pillar 2 — Foreign official

Doctrine. Officers and employees of foreign governments, their departments, agencies, and instrumentalities; officials of public international organizations; foreign political parties and officials; and candidates for foreign office.

Anchor. United States v. Esquenazi, 752 F.3d 912, 925 (11th Cir. 2014) — an instrumentality is "an entity controlled by the government of a foreign country that performs a function the controlling government treats as its own," assessed on control factors (ownership, appointment power, funding, profits) and function factors (monopoly, subsidy, public service, public perception).

Trap. In many markets, ordinary commercial counterparties are foreign officials — employees of state-owned oil companies, national carriers, public hospitals, sovereign wealth funds, state banks, and public universities. A gift and hospitality policy calibrated to private-sector norms is inadequate there, and sales teams do not know it.

Trap, second order. Public international organizations. Anyone performing development-bank-financed work is dealing with foreign officials, and the multilateral banks maintain their own sanctions regimes with cross-debarment among institutions.

Go deeper: The Foreign Corrupt Practices Act: A Comprehensive Guide · International Trade Law: A Comprehensive Guide to Customs, Tariffs, and Trade Remedies

Pillar 3 — Third-party intermediaries

Doctrine. Payments to any person while knowing all or part will be given to a foreign official are covered — and "knowing" is satisfied by awareness of a high probability, which is to say by deliberate ignorance.

Anchor. 15 U.S.C. § 78dd-1(a)(3) and § 78dd-1(f)(2).

Trap. The failure is almost never the absence of a diligence process. It is diligence performed and red flags unresolved. The file shows a questionnaire, a screening report noting the agent's brother-in-law works at customs, and no record that anyone did anything about it.

Trap, second order. Fee structure. A percentage-of-value fee for a service normally billed hourly or per transaction is the most reliable single indicator, and it is visible in the contract without any investigation at all.

Trap, third order. Audit rights never exercised. A contractual right that has never been used, in a program's entire history, is treated as decorative.

Go deeper: Building an Anti-Corruption Compliance Program: A Practical Checklist · The Commercial Contracts Toolkit: Drafting, Reviewing, and Enforcing Business Agreements

Pillar 4 — Hospitality, charity, and hiring

Doctrine. "Anything of value" has no floor. Travel, meals, entertainment, charitable contributions to entities connected to officials, and employment for officials' relatives are all things of value. The only statutory shelter is the affirmative defense for reasonable and bona fide expenditures directly related to promotion or contract performance. § 78dd-1(c)(2).

Anchor. § 78dd-1(f)(1) ("anything of value"); § 78dd-1(c)(2) (bona fide expenditures defense).

Trap. Drift. A plant tour becomes a tour plus a weekend, then a companion, then a cash per diem, then a side trip with no business content. Each step is defensible; the sequence is not. The control almost nobody implements is cumulative tracking per recipient per year — without it, the pattern is invisible internally and obvious to an investigator.

Trap, second order. Referral hiring. Multiple substantial resolutions have rested on internal spreadsheets tracking candidates by government sponsor and correlating hires with business awarded. The candidate's qualifications are not a defense; the purpose of the hire is the issue.

Trap, third order. Charitable contributions requested by an official. A donation to a foundation chaired by the minister approving your license is a thing of value however genuine the charity.

Go deeper: Building an Anti-Corruption Compliance Program: A Practical Checklist · Forming and Operating a Nonprofit: A Comprehensive Guide to Tax-Exempt Status

Pillar 5 — Facilitation payments

Doctrine. The FCPA excepts payments to expedite routine governmental action — permits, visas, police protection, mail, inspections, utilities — but expressly excludes any decision to award or continue business. § 78dd-1(b), (f)(3).

Anchor. § 78dd-1(f)(3)(A)–(B).

Trap. Relying on it. The UK Bribery Act has no facilitation payment exception. Local law prohibits these payments essentially everywhere. And a permitted facilitation payment must still be accurately recorded — which companies that permit them almost never do, converting a lawful payment into an accounting violation.

The recommended policy: flat prohibition, with a narrow documented exception only for payments under duress where health or safety is at risk, reported immediately and recorded accurately. Write down the reasoning for the decision.

Go deeper: The Foreign Corrupt Practices Act: A Comprehensive Guide

Pillar 6 — Jurisdiction and its one real limit

Doctrine. Issuers are covered through interstate commerce or, for U.S. issuers, on a nationality basis. Domestic concerns are covered on a nationality basis with no territorial act required. Foreign persons are covered for acts taken while in U.S. territory.

Anchors. § 78dd-1(g); § 78dd-2(i); § 78dd-3; United States v. Hoskins, 902 F.3d 69 (2d Cir. 2018); Gebardi v. United States, 287 U.S. 112 (1932).

Trap. Overreading Hoskins. It shields a foreign national outside the statutory categories from conspiracy and accomplice liability — but not one who acted as an agent of a domestic concern or issuer, and agency is a fact question. It has not been adopted everywhere. And it does not touch money laundering charges under 18 U.S.C. §§ 1956 and 1957, which the government uses routinely to reach the same conduct.

Go deeper: White Collar Crime and Corporate Criminal Liability: A Comprehensive Guide

Pillar 7 — Attribution

Doctrine. Respondeat superior for employees and agents acting within the scope of employment and at least in part to benefit the company; agency for third parties, turning on the right to control rather than the contract label; parent liability through agency, participation, or the accounting provisions; joint venture liability by ownership and control; and successor liability in acquisitions.

Anchors. § 78m(b)(6) (50%-or-less good faith influence standard); Department policy on successor liability and pre-acquisition conduct.

Trap. Ownership percentage is a compliance decision. Above 50%, a subsidiary's books are the issuer's books. At or below 50%, the obligation is only good-faith influence — but that must be documented: board proposals made, policies offered, training funded.

Trap, second order. M&A. An acquirer takes on the target's ongoing conduct at closing regardless of knowledge. The available protection is a documented sequence — risk-based pre-signing diligence, specific reps and indemnities, pre-closing remediation covenants, day-one integration, a post-closing audit, and prompt disclosure of what is found. Department policy has consistently indicated that acquirers who follow it are not charged for pre-acquisition conduct.

Go deeper: Conducting Merger and Acquisition Due Diligence: A Practical Checklist · Mergers and Acquisitions: A Comprehensive Guide from Letter of Intent to Closing · Running Multiple Businesses Under One Structure

Pillar 8 — Program design

Doctrine. Not doctrine — the published hallmarks. Senior commitment and clear policy; code and procedures; oversight with autonomy and resources; documented risk assessment; targeted training and continuing advice; incentives and discipline; third-party diligence and payment controls; confidential reporting and investigation; continuous testing and review; and M&A diligence and integration.

Anchor. DOJ/SEC Resource Guide (2d ed. 2020); DOJ Criminal Division, Evaluation of Corporate Compliance Programs; U.S.S.G. § 8B2.1.

Trap. The three questions are is it well designed, is it adequately resourced and empowered, and does it work in practice — and programs fail the third. Testing performed, investigations conducted, discipline actually imposed, and changes made in response to findings are the only evidence that answers it.

Trap, second order. "Adequately empowered" is proved by an instance where compliance's position prevailed over commercial preference. Most programs cannot produce one, and that absence is noticed.

Go deeper: Building an Anti-Corruption Compliance Program: A Practical Checklist · The Corporate Compliance Toolkit · Antitrust Compliance: A Practical Checklist

Pillar 9 — Cross-border investigation

Doctrine. Not FCPA doctrine — the constraints that govern how an investigation can actually be run across jurisdictions.

Anchors. Upjohn Co. v. United States, 449 U.S. 383 (1981) (corporate privilege and employee warnings); GDPR and national data protection laws; foreign blocking statutes; works council consultation requirements.

Trap. Privilege abroad. Several civil law jurisdictions do not recognize privilege for in-house counsel communications, and materials routine in the U.S. may be seizable in a dawn raid elsewhere. Structure the investigation through outside counsel where that matters and know which jurisdictions those are before collecting.

Trap, second order. Blocking statutes criminalize producing evidence for foreign proceedings in some countries. Plan the data strategy with local counsel before collection, not after a production demand.

Trap, third order. Scope. An investigation scoped only to the reported allegation misses the pattern; one scoped to everything costs more than the exposure. Risk-based scoping with documented reasoning, revisited as facts develop, is the answer.

Go deeper: Conducting a Workplace Investigation: A Practical Checklist · Moving Personal Data Out of the EU After Schrems II: SCCs and Transfer Impact Assessments · Responding to a Government Subpoena or Investigation: A Practical Checklist

Pillar 10 — Disclosure and resolution

Doctrine. Department policy has offered a presumption of declination for voluntary self-disclosure with full cooperation, timely remediation, and disgorgement, absent aggravating circumstances — with fine reductions and, ordinarily, no monitor where an effective program has been implemented and tested.

Anchors. Justice Manual JM 9-47.120 (verify current text); 18 U.S.C. § 3571(d) (Alternative Fines Act — twice gross gain or loss); Liu v. SEC, 591 U.S. 71 (2020) (disgorgement limited to net profits); Kokesh v. SEC, 581 U.S. 455 (2017), and the NDAA for FY2021's ten-year period for scienter-based disgorgement; 18 U.S.C. § 3292 (tolling for foreign evidence requests).

Trap. The Alternative Fines Act is where the headline numbers come from. Statutory maxima of $2 million and $25 million are almost never the operative figure.

Trap, second order. Disclosure credit evaporates if the government already knows. Whistleblowers, the SEC award program, foreign regulators, and JV partners all surface conduct. Assess likelihood of independent discovery honestly and early.

Trap, third order. Monitors. What determines imposition is whether an effective program has been implemented and tested by the time of resolution — which is a reason to build the program before there is a problem and a reason to remediate visibly during the investigation.

Go deeper: SEC Enforcement: A Comprehensive Guide to Investigations, Wells Notices, and Remedies · Responding to an SEC Investigation and Wells Notice: A Practical Checklist

Pillar 11 — The global regime

Doctrine. The FCPA sits inside a network of national statutes and multilateral conventions, several broader than it.

Anchors. UK Bribery Act 2010 — ss. 1–2 (commercial bribery), s. 6 (foreign officials), and s. 7 (strict liability corporate failure to prevent, subject only to an adequate procedures defense), with jurisdiction over any organization carrying on a business or part of a business in the UK. France — Sapin II (2016), requiring eight enumerated compliance measures supervised by the AFA, with the convention judiciaire d'intérêt public as the DPA analogue. Brazil — Clean Company Act (Law 12.846/2013), strict corporate liability up to 20% of gross revenue, mitigated by compliance programs and leniency agreements. OECD Anti-Bribery Convention and UNCAC. Foreign Extortion Prevention Act, 18 U.S.C. § 1352, criminalizing the foreign official's demand side.

Trap. Section 7 makes the compliance program the only defense, and it applies to "associated persons" — agents, subsidiaries, and joint venture partners performing services for the organization. A U.S. company that acquires a UK business has just adopted the harder standard. Map the program against the six UK principles explicitly and keep the mapping.

Trap, second order. Sequencing disclosures across authorities. Disclosure to one frequently triggers others, and U.S. crediting of penalties paid elsewhere is negotiated, not automatic.

Go deeper: Export Controls and Economic Sanctions: A Comprehensive Guide to the EAR, ITAR, and OFAC · The International Trade and Sanctions Toolkit

Pillar 12 — The adjacent statutes

Doctrine. Where the FCPA does not reach, other statutes do.

Anchors. Travel Act, 18 U.S.C. § 1952 — reaches commercial bribery through state law predicates. Money laundering, 18 U.S.C. §§ 1956, 1957 — foreign corruption is a specified unlawful activity, and Hoskins does not limit it. Wire and mail fraud and honest services fraud, 18 U.S.C. § 1346. Tax — no deduction for illegal bribes under 26 U.S.C. § 162(c). Anti-Money Laundering Act of 2020 — expanded foreign bank records subpoena authority and a new whistleblower award program. Sanctions and export controls, which travel with corruption facts more often than not.

Trap. Advising that conduct falls outside the FCPA and stopping there. Commercial bribery — paying a private-sector purchasing manager — is not an FCPA violation and is a Travel Act violation and a UK Bribery Act violation. Companies that train only on foreign officials leave that gap open.

Go deeper: White Collar Crime and Corporate Criminal Liability: A Comprehensive Guide · Export Control and Sanctions Compliance: A Practical Checklist

The authority shelf

Statute

  • 15 U.S.C. §§ 78dd-1, 78dd-2, 78dd-3 (anti-bribery)
  • 15 U.S.C. § 78m(b)(2), (b)(5), (b)(6), (b)(7) (accounting)
  • 15 U.S.C. § 78ff (penalties)
  • 28 C.F.R. Part 80 (opinion procedure)

Cases

  • United States v. Esquenazi, 752 F.3d 912 (11th Cir. 2014)
  • United States v. Kay, 359 F.3d 738 (5th Cir. 2004)
  • United States v. Hoskins, 902 F.3d 69 (2d Cir. 2018)
  • Gebardi v. United States, 287 U.S. 112 (1932)
  • Upjohn Co. v. United States, 449 U.S. 383 (1981)
  • Kokesh v. SEC, 581 U.S. 455 (2017)
  • Liu v. SEC, 591 U.S. 71 (2020)

Adjacent

  • 18 U.S.C. § 1352 (FEPA)
  • 18 U.S.C. § 1952 (Travel Act)
  • 18 U.S.C. §§ 1956, 1957 (money laundering)
  • 18 U.S.C. § 3571(d) (Alternative Fines Act)
  • 18 U.S.C. § 3292 (tolling for foreign evidence)
  • 26 U.S.C. § 162(c) (no deduction)

Guidance

  • DOJ/SEC, A Resource Guide to the U.S. Foreign Corrupt Practices Act (2d ed. 2020)
  • DOJ Criminal Division, Evaluation of Corporate Compliance Programs
  • Justice Manual §§ 9-28.000 (Principles of Federal Prosecution of Business Organizations), 9-47.120 (FCPA policy)
  • U.S.S.G. § 8B2.1 (effective compliance and ethics program)

Foreign and multilateral

  • UK Bribery Act 2010, ss. 1, 2, 6, 7, and the Ministry of Justice guidance on adequate procedures
  • France, Loi Sapin II (2016)
  • Brazil, Lei 12.846/2013 (Clean Company Act)
  • OECD Convention on Combating Bribery of Foreign Public Officials (1997)
  • United Nations Convention Against Corruption (2003)

Secondary sources

  • Transparency International, Corruption Perceptions Index (a risk-assessment input, not a legal standard)
  • OECD Working Group on Bribery country monitoring reports
  • Stanford Law School FCPA Clearinghouse (enforcement data)

Appendix A — The red flag register

Any one of these requires documented resolution before engagement or payment. Three or more should stop the transaction pending investigation.

Relationship formation

  1. The intermediary was recommended or required by the government customer.
  2. The relationship is proposed immediately before a major award.
  3. The intermediary has family or business ties to officials with decision authority.
  4. The intermediary refuses anti-corruption representations, audit rights, or diligence.
  5. The intermediary was selected without a documented alternative having been considered.

Economics 6. The fee is disproportionate to the service. 7. The fee is a percentage of contract value for a service normally billed hourly or per transaction. 8. The fee increased sharply without a change in scope. 9. Success fees contingent on a government decision.

Substance 10. The intermediary is a shell — no offices, staff, website, or verifiable track record. 11. There is no documentation of services performed — no reports, deliverables, or correspondence. 12. Nobody can answer "what exactly do they do?"

Payment 13. Request for payment to a third country or to an account not in the counterparty's name. 14. Request for cash or payment to an individual. 15. Invoices lacking detail sufficient to identify the work. 16. Payment splitting to stay below approval thresholds.

Context 17. Operations in a high-risk jurisdiction with a state-owned customer. 18. Unusual speed in obtaining permits, clearances, or approvals. 19. Employee resistance to compliance review or claims that "this is how it works here." 20. Turnover in the local finance function.

Appendix B — First ninety days on a new anti-corruption engagement

Days 1–15. Establish governance: board resolution, CCO with board access, documented authority and budget. Collect the existing policy set, third-party register, and organizational chart. Identify whether the client is an issuer, a domestic concern, or both — and whether it carries on part of a business in the UK.

Days 16–30. Run the risk assessment. Map countries, government touchpoints, state-owned counterparties, third parties by spend and interface, and high-risk transaction types. Document methodology and conclusions. This drives everything downstream.

Days 31–45. Build the third-party inventory. For each intermediary: engagement rationale, diligence status, contract terms, fee structure, spend trend, and evidence of services. Flag against the Appendix A register.

Days 46–60. Policy build. Code, anti-corruption policy, GTE policy with cumulative tracking, charitable and political contribution policy, third-party engagement policy, and books-and-records policy — translated, with an exception and escalation process. Make the facilitation payment decision explicitly and record the reasoning.

Days 61–75. Controls. Payment approval, third-country and third-party payment prohibitions, petty cash limits, journal entry testing, and segregation of duties in small locations. Re-paper third-party agreements with anti-corruption terms, audit rights, and payment restrictions.

Days 76–90. Operate. Deliver role-based training in local languages with local scenarios. Stand up the reporting channel with a documented triage and resolution process. Run the first transaction testing cycle in the highest-risk market. Map the program against the UK six principles. Report to the board with metrics and a remediation plan tracked to closure.

The deliverable at day 90 is not a binder. It is the ability to answer, for every third party with a government interface, what they do, how it was diligenced, what was paid, and what evidence exists that the service was performed.

Related Documents

Guides

Articles

Checklists

Toolkits